.github
app
chewy
controllers
activitypub
admin
api
v1
web
embeds_controller.rb
push_subscriptions_controller.rb
settings_controller.rb
base_controller.rb
oembed_controller.rb
push_controller.rb
salmon_controller.rb
subscriptions_controller.rb
auth
concerns
oauth
settings
well_known
about_controller.rb
account_follow_controller.rb
account_unfollow_controller.rb
accounts_controller.rb
application_controller.rb
authorize_follows_controller.rb
emojis_controller.rb
follower_accounts_controller.rb
following_accounts_controller.rb
home_controller.rb
intents_controller.rb
invites_controller.rb
manifests_controller.rb
media_controller.rb
media_proxy_controller.rb
remote_follow_controller.rb
remote_unfollows.rb
shares_controller.rb
statuses_controller.rb
stream_entries_controller.rb
tags_controller.rb
helpers
javascript
lib
mailers
models
policies
presenters
serializers
services
validators
views
workers
bin
config
db
docs
lib
log
nanobox
public
spec
streaming
vendor
.babelrc
.buildpacks
.codeclimate.yml
.dockerignore
.editorconfig
.env.nanobox
.env.production.sample
.env.test
.env.vagrant
.eslintignore
.eslintrc.yml
.foreman
.gitattributes
.gitignore
.haml-lint.yml
.nanoignore
.nvmrc
.postcssrc.yml
.profile
.rspec
.rubocop.yml
.ruby-version
.scss-lint.yml
.slugignore
.travis.yml
.yarnclean
AUTHORS.md
Aptfile
CODE_OF_CONDUCT.md
CONTRIBUTING.md
Capfile
Dockerfile
Gemfile
Gemfile.lock
LICENSE
Procfile
Procfile.dev
README.md
Rakefile
Vagrantfile
app.json
boxfile.yml
config.ru
docker-compose.yml
jest.config.js
package.json
scalingo.json
yarn.lock
537d2939b1
CSRF token checking was enabled for API controllers in #6223, producing "Can't verify CSRF token authenticity" log spam. This disables logging of failed CSRF checks. This also changes the protection strategy for PushSubscriptionsController to use exceptions, making it consistent with other controllers that use sessions.
56 lines
1.5 KiB
Ruby
56 lines
1.5 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
class Api::Web::PushSubscriptionsController < Api::BaseController
|
|
respond_to :json
|
|
|
|
before_action :require_user!
|
|
protect_from_forgery with: :exception
|
|
|
|
def create
|
|
params.require(:subscription).require(:endpoint)
|
|
params.require(:subscription).require(:keys).require([:auth, :p256dh])
|
|
|
|
active_session = current_session
|
|
|
|
unless active_session.web_push_subscription.nil?
|
|
active_session.web_push_subscription.destroy!
|
|
active_session.update!(web_push_subscription: nil)
|
|
end
|
|
|
|
# Mobile devices do not support regular notifications, so we enable push notifications by default
|
|
alerts_enabled = active_session.detection.device.mobile? || active_session.detection.device.tablet?
|
|
|
|
data = {
|
|
alerts: {
|
|
follow: alerts_enabled,
|
|
favourite: alerts_enabled,
|
|
reblog: alerts_enabled,
|
|
mention: alerts_enabled,
|
|
},
|
|
}
|
|
|
|
data.deep_merge!(params[:data]) if params[:data]
|
|
|
|
web_subscription = ::Web::PushSubscription.create!(
|
|
endpoint: params[:subscription][:endpoint],
|
|
key_p256dh: params[:subscription][:keys][:p256dh],
|
|
key_auth: params[:subscription][:keys][:auth],
|
|
data: data
|
|
)
|
|
|
|
active_session.update!(web_push_subscription: web_subscription)
|
|
|
|
render json: web_subscription.as_payload
|
|
end
|
|
|
|
def update
|
|
params.require([:id, :data])
|
|
|
|
web_subscription = ::Web::PushSubscription.find(params[:id])
|
|
|
|
web_subscription.update!(data: params[:data])
|
|
|
|
render json: web_subscription.as_payload
|
|
end
|
|
end
|